Overview

overview

10

Static

static

10

zmap.arm7.elf

debian-12-armhf

7

Analysis

  • max time kernel
    130s
  • max time network
    149s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20240418-en
  • resource tags

    arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    13-12-2024 09:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    zmap.arm7.elf

  • Size

    152KB

  • MD5

    9ce68a667c961a44758e17f18e39419d

  • SHA1

    94e93cd72a812771cb287774caec8db0620778a5

  • SHA256

    17d8a0966c1b3e904e9a38c0bc508575744fe2c83c0eced9ab9c1b78a4d2977d

  • SHA512

    1714462669e8ddb172e2f54b026c2044678916da69e9d8a247ec43806331c29296a800e7e7e0c1d557672bb2897490020072d006b8f0dd47f4708b2ec9a10f05

  • SSDEEP

    3072:gXNsG9xNku03aoanAE+zRzHnbNc57VMzzLSO4PFM/9h7TBA:gXNsiEuToanL+zRzHbNyYLS7dM/9Zy

Score
7/10
defense_evasion

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Writes file to system bin folder 2 IoCs
  • Changes its process name 1 IoCs

Processes

  • /tmp/zmap.arm7.elf
    /tmp/zmap.arm7.elf
    1⤵
    • Deletes itself
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Changes its process name
    PID:705

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads